Security

Mozilla's recommended security headers and settings for websites: CSP, HSTS, cookie flags, CORS, SRI. in Web & Frontend →

A small reference site that explains CORS with copy-paste configurations for dozens of servers and frameworks (Apache, nginx, Node, IIS and more). in Backend, API & System Design →

Reference for the main/renderer process split and the IPC between them. in Mobile & Desktop →

A test site that serves subdomains with deliberately broken TLS setups (expired, self-signed, wrong host and so on). in Testing & QA →

A French test site that grades the TLS setup of HTTPS, SMTP and XMPP servers by cipher suite, certificate and key exchange. in Testing & QA →

A Google tool that flags bypassable rules (unsafe-inline, broad wildcards, missing directives) when you paste in a Content-Security-Policy header. in Testing & QA →

A scanner that gathers a domain's DNS, email (SPF/DKIM/DMARC), TLS and web-header security into one report. in Testing & QA →

A page that grades your browser's TLS client setup (version, cipher suites, known weaknesses). in Testing & QA →

Mozilla's in-browser checker that scores a site's headers, cookies and TLS settings against security best practice; it now lives inside MDN. in Testing & QA →

Code review as a service from vetted professional reviewers; since HackerOne acquired it, it runs as HackerOne Code with a focus on secure code review. in Testing & QA →

A browser-based scan that grades a site's HTTP response headers (CSP, HSTS, X-Frame-Options, Permissions-Policy and so… in Testing & QA →

A test that scans a site’s TLS configuration and grades it A–F. in Testing & QA →

Cloudflare agent skill that guides coding agents through contextual security audits and secret-leak checks across a… in AI · Agents & Infrastructure →

Scans model files for malicious payloads — because pickle deserialisation can execute arbitrary code, a downloaded checkpoint is a real attack surface. in AI · Agents & Infrastructure →

Surfaces which AI tools employees send what data to, and blocks by policy. in AI · Agents & Infrastructure →

A distributed AutoML platform. Unlike library-only solutions, it also brings explainability and productionisation… in AI · Applied Tools →

Infrastructure offering CDN, DNS, DDoS protection and edge computing in one platform. in DevOps & Infrastructure →

The Sysinternals tool that lists everything Windows runs at startup: services, scheduled tasks, shell extensions, drivers. in Networking & Sysadmin →

A resource list for eBPF, which runs safe programs inside the kernel. in Networking & Sysadmin →

The CCSA and CCSE certifications. What differs from other firewall vendors is that Check Point’s management… in Networking & Sysadmin →

A reference site that lists every TLS cipher suite searchably, with IANA and OpenSSL names, a security rating… in Networking & Sysadmin →

Verisign's tool that validates a domain's DNSSEC chain of trust from the root down and shows where it breaks. in Networking & Sysadmin →

The NSE programme and security training. Against other vendor programmes most of it has been made free — the broadest… in Networking & Sysadmin →

A Cloudflare page that tests from your browser whether your ISP filters invalid BGP routes (RPKI). in Networking & Sysadmin →

The source of cryptographic standards, where you check which algorithms remain approved; the post-quantum selections were published here too. in Networking & Sysadmin →

A step-by-step guide to building a root and intermediate certificate authority with OpenSSL, signing certificates and publishing revocation lists. in Networking & Sysadmin →

Turns the operating system into something you query with SQL — running processes, open ports and installed packages become tables. in Networking & Sysadmin →

PCNSA and PCNSE certifications with firewall and cloud security training. in Networking & Sysadmin →

A mesh VPN on top of WireGuard that connects your devices directly even behind NAT and firewalls. in Networking & Sysadmin →

The automation engineering society, awarding certificates against the IEC 62443 industrial cybersecurity standard. in Hardware, CAD & Embedded →

Reverse-engineering of the device’s BLE protocol — the only route to uses the official SDK does not permit. in Smart Glasses & Wearables →

Community projects around Ray-Ban Meta glasses. in Smart Glasses & Wearables →

The EFF’s browser fingerprinting test, measuring how unique your browser looks and how well it resists trackers. in Privacy & Personal Security →

A categorised personal digital-security checklist of 300+ items, each with recommended tools and settings. in Privacy & Personal Security →

The free implementation of the OpenPGP standard, a command-line tool for encrypting, signing and key management. in Privacy & Personal Security →

Checks whether an email address or password appears in known breaches. in Privacy & Personal Security →

Estimates how long a password would take to brute-force, computed in the browser so the password is never sent. in Privacy & Personal Security →

An open-source password manager that keeps passwords in a locally encrypted vault. in Privacy & Personal Security →

A community guide to hardening macOS step by step: FileVault, firewall, DNS, VPN and app permissions. in Privacy & Personal Security →

Anti-malware software that detects and removes malicious software. in Privacy & Personal Security →

A Swedish VPN that asks for no email at signup — it hands you a random account number and takes cash. in Privacy & Personal Security →

A table comparing messaging apps on encryption, metadata, openness and audit status. in Privacy & Personal Security →

A form that generates the /.well-known/security.txt file (RFC 9116) telling security researchers where to report a… in Privacy & Personal Security →

Messaging with no notion of a user identity: no phone number, no username, not even a persistent ID. in Privacy & Personal Security →

A live Linux distribution that runs from USB and routes everything through Tor. in Privacy & Personal Security →

End-to-end encrypted email and calendar that encrypts the whole mailbox, subject lines and address book included. in Privacy & Personal Security →

A wiki that gathers application security resources (guides, tools, checklists, training) in one place. in Offence, Defence & OSINT →

A list gathering the annual cybersecurity reports of research consultancies and government agencies in one place. in Offence, Defence & OSINT →

A list of tools officially presented at Black Hat events, and only those. in Offence, Defence & OSINT →

A list of CAPTCHA types and libraries used to tell humans from bots. in Offence, Defence & OSINT →

A list for security research on IoT, embedded, industrial and automotive systems, gathering hardware attacks, wireless… in Offence, Defence & OSINT →

A list of theory-basics papers on cryptography for non-cryptographers. in Offence, Defence & OSINT →

A list of detection, monitoring and response tools for the defensive (blue team) side. in Offence, Defence & OSINT →

A year-by-year archive of cybersecurity blog posts, write-ups and papers, with entries up to 2026. in Offence, Defence & OSINT →

Resources for designing and operating the detection rules that catch attacks. in Offence, Defence & OSINT →

A list of tools and practices embedding security into the CI/CD pipeline. in Offence, Defence & OSINT →

A compilation of fuzzing resources: tools, books, talks, papers and practice environments. in Offence, Defence & OSINT →

A resource list specific to game security — anti-cheat, reverse engineering, protection bypasses. in Offence, Defence & OSINT →

A list that collects awesome lists for hackers, pentesters and researchers. in Offence, Defence & OSINT →

A list of decoy systems (honeypots) set up to lure attackers. in Offence, Defence & OSINT →

A resource list for user accounts, authentication and authorisation. in Offence, Defence & OSINT →

A security-oriented resource list on industrial network protocols such as Modbus, S7 and OPC UA, with a page and dataset per protocol. in Offence, Defence & OSINT →

A list of tools and papers on the “prompt injection” vulnerability specific to language models. in Offence, Defence & OSINT →

A resource list focused on web security, split by attack class (XSS, SSRF, deserialisation). in Offence, Defence & OSINT →

A crowdsourced vulnerability (bug bounty) platform connecting companies with security researchers. in Offence, Defence & OSINT →

Cryptographer David Wong’s blog and notes on applied cryptography. in Offence, Defence & OSINT →

A tidy note archive of security topics. Unlike comprehensive handbooks it is pruned for speed — a quick reference for… in Offence, Defence & OSINT →

Advanced courses on malware development and offensive tooling. in Offence, Defence & OSINT →

Offensive Security's searchable archive of published exploits and vulnerability write-ups, indexed by CVE. in Offence, Defence & OSINT →

The NSA's open source reverse engineering framework with disassembler, decompiler and scripting. in Offence, Defence & OSINT →

Exposes Ghidra to an assistant over MCP, letting you delegate the tedious parts — reading disassembly, naming functions. in Offence, Defence & OSINT →

A list of Unix binaries that can be abused to escape restricted shells, escalate privileges or read files. in Offence, Defence & OSINT →

A bug bounty platform where you legally test real systems within a company-defined scope. in Offence, Defence & OSINT →

A knowledge base giving pentest, red-team, web, cloud and privilege-escalation techniques as step-by-step commands. in Offence, Defence & OSINT →

A security channel demonstrating penetration testing tools and techniques hands-on. in Offence, Defence & OSINT →

A numbered collection of XSS vectors arising from HTML5 and browser quirks, each listing the browsers it works in. in Offence, Defence & OSINT →

Tools, protocol notes, sample pcaps, configurations and guides for industrial control system (ICS/SCADA) security. in Offence, Defence & OSINT →

A service enumeration script automating the command sequence you would otherwise run by hand during reconnaissance. in Offence, Defence & OSINT →

A vast security reference under one roof — red team, blue team, DFIR, AppSec and more. in Offence, Defence & OSINT →

The non-profit publishing the OSSTMM security testing methodology. in Offence, Defence & OSINT →

The wiki of Kicksecure, a hardened Debian derivative, covering system hardening, kernel and browser settings, Tor and password management step by step. in Offence, Defence & OSINT →

An Austrian firm focused on industrial control systems and critical infrastructure, with OT security training. in Offence, Defence & OSINT →

The repositories of a developer producing Turkish security and IT material. in Offence, Defence & OSINT →

Ready-made lists for weeding false positives out of threat indicators — public DNS resolvers, known cloud ranges, public services. in Offence, Defence & OSINT →

An open source proxy that intercepts, inspects, modifies and replays HTTP(S) traffic, with terminal, web and scripting interfaces. in Offence, Defence & OSINT →

An open wiki gathering 5,000+ cybersecurity links sorted by specialism. in Offence, Defence & OSINT →

A resource set covering every branch of offensive security — infrastructure, wireless, IoT, exploit development, cloud — together with labs. in Offence, Defence & OSINT →

An introduction to fuzzing from OWASP’s own community pages: how it works, which tools exist, which classes of bug it finds. in Offence, Defence & OSINT →

The OWASP guide to security testing Android and iOS apps, with test cases, tools and techniques in one place. in Offence, Defence & OSINT →

An open source OWASP tool for drawing data flow diagrams and doing threat modelling with methods such as STRIDE, with web and desktop versions. in Offence, Defence & OSINT →

Payloads and bypass notes for web security and CTFs, organised by vulnerability class (SQLi, SSRF, XXE, SSTI and more). in Offence, Defence & OSINT →

An e-zine of the hacker community, published since 1985, with deep technical articles on exploitation, kernels and network security. in Offence, Defence & OSINT →

A list that automatically harvests CVE proof-of-concept repositories from GitHub and updates daily. in Offence, Defence & OSINT →

Open-source command-line tool built to streamline reverse engineering and binary triage workflows; enables fast initial… in Offence, Defence & OSINT →

A hand-curated guide to links and resources split by topic for SOC, pentesting, DFIR, threat intelligence and AppSec. in Offence, Defence & OSINT →

The SANS Institute’s security cheat sheets: forensics, incident response, memory analysis, the Windows registry. in Offence, Defence & OSINT →

Turkey’s cyber security authority, publishing national advisories, regulation and critical-infrastructure guidance. in Offence, Defence & OSINT →

A repository that makes the content extracted from thousands of threat-intelligence reports searchable. in Offence, Defence & OSINT →

A repository that automatically gathers and keeps current every known CVE, with links to proof-of-concept code where it exists. in Offence, Defence & OSINT →

A live IOC feed that collects malicious URLs, domains, IPs and hashes shared by the infosec community on Twitter/X, served as CSV/JSON/RSS/API. in Offence, Defence & OSINT →

A scanning service that opens a URL in a real browser and records every request the page makes, the domains it contacts, a screenshot and the DOM. in Offence, Defence & OSINT →

A single page listing web application security tests as a mind map; each branch is a test area with its tools. in Offence, Defence & OSINT →

A list of tools, wargames and tutorials for Capture The Flag. in CTF & Hands-on Labs →

A downloadable, deliberately vulnerable app containing 100+ web vulnerabilities. in CTF & Hands-on Labs →

A step-by-step solution of the internet’s best-known puzzle, chaining steganography, book ciphers and Tor hidden services. in CTF & Hands-on Labs →

A user-submitted archive of reverse engineering challenges (crackmes), filterable by difficulty, language and platform. in CTF & Hands-on Labs →

A set of 48 programming exercises in 8 sets that teach cryptography by attacking real constructions; you write the attacks yourself. in CTF & Hands-on Labs →

A site scheduling Capture The Flag competitions worldwide and keeping team rankings. in CTF & Hands-on Labs →

A deliberately vulnerable iOS app for learning mobile security. in CTF & Hands-on Labs →

A Google-built test target hosting many application-security issues. in CTF & Hands-on Labs →

A modern, vulnerability-filled web app practice target built by PortSwigger. in CTF & Hands-on Labs →

Every challenge from Google’s CTF competitions, with source code and solutions. in CTF & Hands-on Labs →

Google’s “full of holes” codelab teaching web application flaws. in CTF & Hands-on Labs →

Realistic machines with no hints — reconnaissance and research are entirely on you. in CTF & Hands-on Labs →

Module-based learning with practical certifications such as CPTS and CBBH. in CTF & Hands-on Labs →

A long-running site with basic hacking missions (basic, realistic, programming, stego) in a legal, safe setting. in CTF & Hands-on Labs →

HackerOne's free video lessons and CTF on finding web vulnerabilities; flags earned can bring invitations to private bug bounty programs. in CTF & Hands-on Labs →

A developer-oriented site that explains common web vulnerabilities (XSS, SQL injection, CSRF) in short interactive lessons. in CTF & Hands-on Labs →

Hands-on, in-browser labs covering penetration testing and web security. in CTF & Hands-on Labs →

An embedded-systems CTF where you break electronic locks using an in-browser MSP430 debugger. in CTF & Hands-on Labs →

Classic wargames you play over SSH, level by level. in CTF & Hands-on Labs →

A modern web app deliberately full of vulnerabilities — a target for learning security. in CTF & Hands-on Labs →

OWASP’s directory of deliberately vulnerable web apps for training. in CTF & Hands-on Labs →

OWASP's web application penetration testing methodology and checklist, from information gathering to business logic flaws. in CTF & Hands-on Labs →

Web and application security exercises where each one explains a vulnerability and gives you a running environment to exploit it. in CTF & Hands-on Labs →

Carnegie Mellon's free CTF platform with web, crypto, reverse engineering and forensics tasks. in CTF & Hands-on Labs →

Arizona State University's free cybersecurity education platform; beginner-friendly modules with in-browser practice… in CTF & Hands-on Labs →

A non-profit wargame site for binary exploitation (pwn), starting at the Toddler's Bottle tier and getting harder. in CTF & Hands-on Labs →

Harder binary exploitation tasks aimed at building pwn skills on near-real vulnerabilities. in CTF & Hands-on Labs →

A community-run French platform with hundreds of challenges and virtual environments across web, cryptography, reverse engineering and forensics. in CTF & Hands-on Labs →

A list of solved and unsolved historical ciphertexts — real material for cryptanalysis practice instead of synthetic exercises. in CTF & Hands-on Labs →

The CTF guide from the security firm Trail of Bits, laying out which skill each category needs and how to build it. in CTF & Hands-on Labs →

Guided labs that explain which tool you are using and why in each room. in CTF & Hands-on Labs →

Docker-compose environments for known CVEs that come up with one command. in CTF & Hands-on Labs →

An archive of community-built vulnerable VMs you download and run locally. in CTF & Hands-on Labs →

PortSwigger’s free, hands-on web-security course — a live lab for each vulnerability. in CTF & Hands-on Labs →

A technical account of how a homophonic substitution cipher unsolved for fifty-one years was broken — a real worked… in CTF & Hands-on Labs →

The category of ciphers still unbroken, the Voynich manuscript and Beale ciphers among them. in CTF & Hands-on Labs →

A UK-based accreditation body certifying both individuals and penetration testing firms. in Certification & Career →

The body behind CEH (Certified Ethical Hacker). in Certification & Career →

The examination arm of SANS training, with over fifty certificates — the broadest catalogue in the field. in Certification & Career →

A certification body devoted to identity and access management. in Certification & Career →

The continuation of eLearnSecurity, awarding practical certificates such as eJPT and eCPPT. in Certification & Career →

The body behind CISA, CISM and CRISC, covering audit, governance and risk. in Certification & Career →

The body behind CISSP. Unlike technical certifications it leans on governance and risk, and passing is not enough: five… in Certification & Career →

A UK firm selling training, consultancy and toolkits around ISO 27001, GDPR and cyber resilience. in Certification & Career →

An alternative body with a catalogue resembling EC-Council’s, awarding C)PTE and C)ISSO among others. in Certification & Career →

A programme of hundreds of practical exercises graded on submitted work rather than a sat exam. in Certification & Career →

The body behind OSCP, formerly Offensive Security. in Certification & Career →

A continually updated cheat sheet of the commands and techniques the OSCP exam most often needs. in Certification & Career →

The Application Security Verification Standard: measurable security requirements in areas such as authentication… in Certification & Career →

Turkish YouTube channel by Prof. Kemal Bıçakcı featuring university lectures and talks on cryptography, application… in Certification & Career →

A business-driven security architecture framework and its certifications. in Certification & Career →

A widely recognised name in security training, with courses feeding into GIAC exams. in Certification & Career →

The roadmap’s HTML source under CC BY-SA. in Certification & Career →

An interactive chart placing security certifications across ten specialisms and four difficulty tiers. in Certification & Career →

Turkish national cybersecurity talent program for university students covering penetration testing, malware analysis… in Certification & Career →

The body behind PNPT, whose exam is a five-day real engagement followed by a report and a live debrief. in Certification & Career →

A self-study curriculum that orders free resources by topic for people teaching themselves information security. in Certification & Career →

A body offering practical exams focused on application and API security. in Certification & Career →

An EUROCONTROL-backed aviation safety knowledge base of accident analyses, human factors and safety management systems. in Science & Academia →

Audited smart-contract libraries and security tooling for Solidity. in Finance, Markets & Crypto →

Product-bound specialist exams across the Symantec and VMware families — they measure configuration of a specific… in Learning & Roadmaps →

Seventy security projects from beginner to advanced, each with source. in Learning & Roadmaps →

A one-page comic that explains HTTPS, certificates and key exchange. in Learning & Roadmaps →

A European body certifying security roles along a tiered path. in Learning & Roadmaps →

A page that walks through every byte of a TLS 1.2 handshake with colour-coded, annotated and hand-computed values. in Learning & Roadmaps →

Teaches cryptography by breaking it, with each level exploiting a real weakness. in Practice & Challenges →

A scenario-based game for learning SELinux that you run on your own machine. in Practice & Challenges →

A browsable, searchable tree of object identifiers (OIDs), handy when decoding X.509 certificate fields. in Cheat Sheets & Quick Reference →

Short, implementation-focused guides on application security topics such as authentication, injection prevention and session management. in Cheat Sheets & Quick Reference →

A filterable list of XSS vectors by tag, event handler and browser. in Cheat Sheets & Quick Reference →

Checks whether a site is flagged as unsafe in Google’s Safe Browsing records. in Converters, Formatters & Checkers →

A simple password generator with adjustable length and character sets. in Converters, Formatters & Checkers →

A form that generates the CAA DNS record, which controls which certificate authorities may issue certificates for your… in Converters, Formatters & Checkers →